Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add legacy OS support #48

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+18 −9
Open

Add legacy OS support #48

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 18 additions & 9 deletions myseatbelt.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ def __init__(self, target, options, logger, verbose=1):
self.__SAMHashes = None
self.__LSASecrets = None
self.global_logfile = b'globallog.log'
self.user_directory = 'Users'
self.init_connect()
#logger.init()

Expand Down Expand Up @@ -384,9 +385,9 @@ def GetChromeSecrets(self):
# Parse chrome
# autres navigateurs ?

user_directories = [("Users\\{username}\\AppData\\Local\\Google\\Chrome\\User Data", 'Local State', 'ChromeLocalState', 'DOMAIN'),
("Users\\{username}\\AppData\\Local\\Google\\Chrome\\User Data\\Default", 'Cookies', 'ChromeCookies', 'DOMAIN'),
("Users\\{username}\\AppData\\Local\\Google\\Chrome\\User Data\\Default", 'Login Data', 'ChromeLoginData', 'DOMAIN'),
user_directories = [(self.user_directory + "\\{username}\\AppData\\Local\\Google\\Chrome\\User Data", 'Local State', 'ChromeLocalState', 'DOMAIN'),
(self.user_directory + "\\{username}\\AppData\\Local\\Google\\Chrome\\User Data\\Default", 'Cookies', 'ChromeCookies', 'DOMAIN'),
(self.user_directory + "\\{username}\\AppData\\Local\\Google\\Chrome\\User Data\\Default", 'Login Data', 'ChromeLoginData', 'DOMAIN')
]


Expand Down Expand Up @@ -667,15 +668,15 @@ def Get_DPAPI_Protected_Files(self):
#CredHistory
#Appdata Roaming ?

user_directories = [("Users\\{username}\\AppData\\Local\\Microsoft\\Credentials",'*','credential','DOMAIN'),
user_directories = [(self.user_directory + "\\{username}\\AppData\\Local\\Microsoft\\Credentials",'*','credential','DOMAIN'),
("Windows\\ServiceProfiles\\ADSync\\AppData\\Local\\Microsoft\\Credentials", '*', 'credential', 'MACHINE-USER'),
("Users\\{username}\\AppData\\Roaming\\Microsoft\\Credentials", '*', 'credential','DOMAIN'),
("Users\\{username}\\AppData\\Local\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.settings","*.rdg",'rdg','DOMAIN')
(self.user_directory + "\\{username}\\AppData\\Roaming\\Microsoft\\Credentials", '*', 'credential','DOMAIN'),
(self.user_directory + "\\{username}\\AppData\\Local\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.settings","*.rdg",'rdg','DOMAIN')
]#ADD Desktop for RDG
machine_directories = [("Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Credentials",'*','credential','MACHINE'),
("Windows\\ServiceProfiles\\ADSync\\AppData\\Local\\Microsoft\\Credentials", '*',
'credential', 'MACHINE-USER'),
("Users\\ADSync\\AppData\\Local\\Microsoft\\Credentials", '*', 'credential', 'MACHINE-USER'),
(self.user_directory + "\\ADSync\\AppData\\Local\\Microsoft\\Credentials", '*', 'credential', 'MACHINE-USER')
#Valider le %systemdir% selon la version de windows ?
]

Expand Down Expand Up @@ -846,7 +847,7 @@ def GetVaults(self):
#autres navigateurs ?
#CredHistory

user_directories = [("Users\\{username}\\AppData\\Local\\Microsoft\\Vault", '*', 'vault','DOMAIN')]
user_directories = [(self.user_directory + "\\{username}\\AppData\\Local\\Microsoft\\Vault", '*', 'vault','DOMAIN')]
machine_directories = [("ProgramData\\Microsoft\\Vault",'*','vault','MACHINE'),
("Windows\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Vault\\",'*','vault','MACHINE')] #Windows hello pincode

Expand Down Expand Up @@ -1357,6 +1358,10 @@ def get_users(self):
self.myfileops.do_use('C$')
#self.myfileops.pwd = 'Users'
completion=self.myfileops.do_ls('Users','*', display=False)
if len(completion) == 0:
self.logging.debug(f"[{self.options.target_ip}] Users path is empty, using alternate legacy path \"Documents and Settings\"")
completion=self.myfileops.do_ls('Documents and Settings','*', display=False)
self.user_directory = 'Documents and Settings'
for infos in completion:
longname, is_directory = infos
if is_directory and longname not in blacklist:
Expand All @@ -1374,6 +1379,10 @@ def get_users(self):
self.myfileops.do_use(share)
#self.pwd = 'Users'
completion=self.myfileops.do_ls('Users','*', display=False)
if len(completion) == 0:
self.logging.debug(f"[{self.options.target_ip}] Users path is empty, using alternate legacy path \"Documents and Settings\"")
completion=self.myfileops.do_ls('Documents and Settings','*', display=False)
self.user_directory = 'Documents and Settings'
for infos in completion:
longname, is_directory = infos
if is_directory and longname not in blacklist:
Expand Down Expand Up @@ -1402,7 +1411,7 @@ def get_masterkeys(self):
for user in self.users:
if user.username != 'MACHINE$':
try:
tmp_pwd = ntpath.join(ntpath.join('Users', user.username),'AppData\\Roaming\\Microsoft\\Protect')
tmp_pwd = ntpath.join(ntpath.join(self.user_directory, user.username),'AppData\\Roaming\\Microsoft\\Protect')
self.logging.debug(f"[{self.options.target_ip}] Looking for {bcolors.OKBLUE}{user.username}{bcolors.ENDC} Masterkey in %s" % tmp_pwd)
my_directory = self.myfileops.do_ls(tmp_pwd,'', display=True)
for infos in my_directory:
Expand Down